Quickstart

Follow the Authentication Guide to sign in, then open the Management Keys page and create a management key. Store it separately from standard application keys. Send it as a bearer token only to Platform Management endpoints.

A standard API key cannot call key or guardrail management endpoints. A valid management key can still receive 403 Forbidden when its owner no longer has the required account role.

Use GET /api/v1/keys to inspect keys visible to the management key’s account:

Use returned public identifiers for later retrieve, update, revoke, or guardrail-assignment requests. Never infer access from a key name or masked token.

Create an application key with POST /api/v1/keys. The full secret is returned only in the create response, so persist it in your secret manager before discarding that response. Rotation should create a replacement, deploy it to the application, verify traffic, and then revoke the old key.

credit_limit_windows accepts any combination of 1h, 1d, and 7d rolling spending caps. If any configured window is exhausted, calls with that key return 429 Too Many Requests until usage leaves the window. Send an empty object when updating a key to clear all rolling caps.

Guardrails are reusable account policies for model, provider, and spending controls. Manage policies through /api/v1/guardrails, then use /api/v1/guardrail_assignments to attach or remove them. Treat a rejected assignment as a policy or ownership failure instead of silently continuing without the guardrail.